DNS Configuration options for Dynamic Host Configuration Protocol for IPv6 (DHCPv6)
Extracted elements (17)
DNS servers in the DNS Recursive Name Server option are listed in order of preference for use by the client resolver, allowing the DHCP server to convey a priority ordering rather than requiring the client to choose arbitrarily.
The Domain Search List option does not apply to name resolution mechanisms other than DNS, scoping its effect strictly to DNS resolver search behavior.
A client's DNS resolver MAY send DNS queries to any of the servers listed in the DNS Recursive Name Server option; servers are listed in order of preference.
A DHCP client SHOULD require DHCP authentication (per RFC 3315) before installing a list of DNS recursive name servers obtained via DHCPv6, to avoid attacks through a rogue DHCP server.
A host SHOULD require the use of DHCP authentication (per RFC 3315) prior to accepting a domain search option from a DHCPv6 server.
Hosts implementing the domain search option SHOULD also implement the searchlist recommendations of RFC 1536, section 6, to minimize vulnerabilities from invalid domain search lists.
The DNS Recursive Name Server option MUST NOT appear in any DHCPv6 message other than: Solicit, Advertise, Request, Renew, Rebind, Information-Request, and Reply.
The Domain Search List option MUST NOT appear in any DHCPv6 message other than: Solicit, Advertise, Request, Renew, Rebind, Information-Request, and Reply.
The list of domain names in the Domain Search List option's 'searchlist' field MUST be encoded as specified in section 'Representation and use of domain names' of RFC 3315.
Where DNS parameters such as the domain searchlist or DNS servers have been manually configured, these parameters SHOULD NOT be overridden by DHCP.
The DNS Recursive Name Server option (OPTION_DNS_SERVERS, code 23) carries a list of one or more IPv6 addresses of DNS recursive name servers. The option-len field must be a multiple of 16, reflecting the 16-byte size of each IPv6 address.
The Domain Search List option (OPTION_DOMAIN_LIST, code 24) carries the domain search list the client uses when resolving hostnames with DNS. It does not apply to other name resolution mechanisms.
IANA assigned option code 23 to OPTION_DNS_SERVERS and option code 24 to OPTION_DOMAIN_LIST from the DHCPv6 option code space defined in RFC 3315.
An intruder DHCP server may use the DNS Recursive Name Server option to redirect DNS queries to a malicious recursive name server, enabling DNS name spoofing. Mitigation requires DHCP authentication per RFC 3315.
An intruder DHCP server may use the Domain Search List option to cause clients to search through invalid domains for incompletely specified names, enabling DNS spoofing. DNSSEC does not avert this attack because records in the invalid domains may be legitimately signed.
OPTION_DNS_SERVERS wire format: 2-octet option-code (23), 2-octet option-len (multiple of 16), followed by one or more 128-bit IPv6 addresses of DNS recursive name servers listed in preference order.
OPTION_DOMAIN_LIST wire format: 2-octet option-code (24), 2-octet option-len (length of searchlist in octets), followed by a searchlist field encoded as specified in RFC 3315 section 'Representation and use of domain names'.